Unscored severity · published Apr 21, 2014
CVE-2014-2341
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter
–
CVSS
5.8%
EPSS
No
On KEV
Description
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.8% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cubecart · Cubecart
through 5.2.8; 5.2.0; 5.2.1; 5.2.2; 5.2.3; 5.2.4; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2341
forums.cubecart.com
http://forums.cubecart.com/topic/48427-cubecart-529-relased/
secunia.com
http://secunia.com/advisories/57856
www.exploit-db.com
http://www.exploit-db.com/exploits/32830
www.osvdb.org
http://www.osvdb.org/105784
www.securityfocus.com
http://www.securityfocus.com/bid/66805
www.securitytracker.com
http://www.securitytracker.com/id/1030086
More from Cubecart
9.8
CVE-2026-34018
An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product
9.8
CVE-2024-34832
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters
9.8
CVE-2018-20716
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature
9.8
CVE-2013-1465
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping…
8.1
CVE-2023-38130
Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system